{
    admin 0.0.0.0:2019
    on_demand_tls {
        ask http://app/api/v1/internal/validate-domain
    }
    servers {
        protocols h1 h2
    }
}

# Bloco HTTP (Túnel Cloudflare e Porta 80 direta)
:80 {
    # Proxy direto para o Reverb (WebSocket)
    # Connection "Upgrade" como valor fixo — browsers podem enviar "keep-alive, Upgrade"
    # transport http { versions 1.1 } — WebSocket exige HTTP/1.1, não HTTP/2
    handle /app/* {
        reverse_proxy reverb:8080 {
            header_up Host {host}
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-Host {host}
            header_up X-Forwarded-Proto {scheme}
            header_up Upgrade {http.request.header.Upgrade}
            header_up Connection "Upgrade"
            transport http {
                versions 1.1
            }
        }
    }

    # Proxy para o resto da aplicação (Nginx)
    handle {
        reverse_proxy app:80
    }
}

# Bloco HTTPS (Porta 443 - SSL Automático On-Demand)
:443 {
    tls {
        on_demand
    }

    # Proxy direto para o Reverb (WebSocket)
    # Caddy termina TLS (wss→ws) e repassa o Upgrade ao Reverb
    # Connection "Upgrade" como valor fixo — browsers podem enviar "keep-alive, Upgrade"
    # transport http { versions 1.1 } — WebSocket exige HTTP/1.1, não HTTP/2
    handle /app/* {
        reverse_proxy reverb:8080 {
            header_up Host {host}
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-Host {host}
            header_up X-Forwarded-Proto {scheme}
            header_up Upgrade {http.request.header.Upgrade}
            header_up Connection "Upgrade"
            transport http {
                versions 1.1
            }
        }
    }

    # Proxy para o resto da aplicação (Nginx)
    handle {
        reverse_proxy app:80
    }
}
